Summary

Removal

Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming
it.

Manual Disinfection

Caution: Manual disinfection is a risky process; it is recommended only for advanced users.

Manual disinfection for SdBot.MB requires renaming of an infected file named SNDCFG16.EXE
located in Windows System folder and restarting a system. Please note that the backdoor's
file has read-only, system and hidden attributes, so Windows Explorer has to be configured
to show such files.

More scanning & removal options

More information on scanning and removal options available in your F-Secure product
can be found in the Help Center.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more assistance.

Network Disinfection

Technical Details

This backdoor steals registration codes of popular games and can work as a keylogger.
It can also steal data, spread to local network and to computers vulnerable to exploits.

This SDBot variant was first found on May 12th, 2004 in Finland.

Installation

The backdoor's file is a PE executable about 93 kilobytes long, packed with Yoda and
PECompact file compressors. When the backdoor's file is started, it copies itself
as SNDCFG16.EXE to Windows System folder, and sets hidden, system and read-only attributes
for itself.

The backdoor creates a number of registry keys. It will also monitor the registry
for changes and recreate these keys if they are deleted or modified.

Activity

SDBot.MB kills the processes of security and anti-virus software and also processes
of certain malware (for example Bagle). Processes with the following names are killed:

regedit.exe

msconfig.exe

netstat.exe

msblast.exe

zapro.exe

navw32.exe

navapw32.exe

zonealarm.exe

wincfg32.exetaskmon.exe

PandaAVEngine.exe

sysinfo.exe

mscvb32.exe

MSBLAST.exe

teekids.exe

Penis32.exe

bbeagle.exe

SysMonXP.exe

winupd.exe

winsys.exe

ssate.exe

rate.exe

d3dupdate.exe

irun4.exe

i11r54n4.exe

The backdoor can scan for vulnerable computers using different types of exploits and
tries to locate other backdoors installed on remote hosts. Here's the list of scanner
capabilities:

WebDav (port 80)

NetBios (port 139)

NTPass (port 445)

DCom (ports 135, 1025)

DCom2 (port 135)

MSSQL (port 1433)

LSASS (port 445)

UPNP (port 5000)

Optix backdoor (port 3140)

Bagle backdoor (port 2745)

Kuang backdoor (port 17300)

Mydoom backdoor (port 3127)

NetDevil backdoor (port 903)

SubSeven backdoor (port 27347)

DameWare remote management software (port 6129)

The backdoor starts IDENTD server on port 113. A hacker can control the backdoor via
a bot that it creates in a certain IRC channel. Backdoor capabilities are the following:

start HTTP server on an infected computer

start FTP server on an infected computer

scan for vulnerable computers (open ports and exploits)

make use of exploits and spread to remote computers

start/stop keylogger

get system information including information about OS, network and drives